Privacy Policy
1. Controller
The controller of your personal data is [COMPANY LEGAL NAME], [REGISTERED ADDRESS]. For anything about your data write to nietspehumancapital@gmail.com.
2. What we collect, why, and on what legal basis
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Email, username, password (stored only as a hash), date you accepted the Terms and confirmed you are 18+ | Create and run your account | Contract, art. 6(1)(b) |
| Positions, orders, balances, cards, watchlist, comments | Provide the Service and show your activity | Contract, art. 6(1)(b) |
| IP address, browser user agent, a random device identifier, sign-in attempts, security events | Keep accounts secure, detect fraud, abuse and market manipulation | Legitimate interest, art. 6(1)(f) |
| Two-factor secret (encrypted) and backup codes (hashed) | Two-factor authentication, if you turn it on | Contract, art. 6(1)(b) |
| Your public Solana wallet addresses and the transactions you make on Nietspe's programs (public on the blockchain) | Show your balances and positions, link your trades to your account | Contract, art. 6(1)(b) |
| Sign-in data from our wallet and authentication provider (Privy): your email or the Google/Apple account you use, and its identifier | Sign-in and creating your wallet | Contract, art. 6(1)(b) |
| Identity verification data (name, date of birth, country, and the documents and checks handled by our verification provider), deposits and withdrawals of your Nietspe balance | Anti-money-laundering and sanctions checks for the custodial balance; keeping the accounting records the law requires | Legal obligation, art. 6(1)(c) |
| Messages you send us | Answer you | Contract or legitimate interest |
We do not sell your data, we do not use it for advertising and we do not use advertising or analytics cookies.
3. Who receives it
Only providers that help us run the Service, under contracts that bind them to protect your data: hosting and database, transactional email , sign-in and wallet infrastructure (Privy, which never sees your funds move without your signature) and blockchain data providers. We disclose data to authorities only when the law requires it. Your username, public activity you choose to share and your comments are visible to other users.
4. Transfers outside the EEA
If a provider processes data outside the European Economic Area, we rely on an adequacy decision or on the European Commission's Standard Contractual Clauses. You can ask us for a copy.
5. How long we keep it
- Account data: while your account is open. When you close it we delete or anonymise your personal details.
- Security logs (sign-ins, IP addresses): up to 12 months.
- Transaction and accounting records: as long as tax and accounting law requires (in Italy, 10 years), without your personal details once your account is closed where the law allows.
- Blockchain transactions are public and permanent: we cannot delete them, only unlink them from your account when you close it.
6. Automated decisions
We use automated checks to detect suspicious sign-ins. When a check blocks something important for you, a person reviews it on request and you can explain your position.
7. Your rights
You can access, correct, delete, restrict or object to the processing of your data, and receive it in a portable format. From Settings you can download your data and close your account yourself; for anything else write to nietspehumancapital@gmail.com. We answer within one month. You also have the right to lodge a complaint with your data protection authority (in Italy, the Garante per la protezione dei dati personali, garanteprivacy.it).
8. Security
Passwords are hashed with bcrypt, sessions use short-lived tokens stored only as hashes, two-factor secrets are encrypted, and traffic is encrypted in transit. No system is perfectly secure: if a breach puts your rights at risk we will tell you and the authority as the law requires.
9. Changes
We will tell you about material changes to this policy before they apply.